The IEEE (Institute of Electrical and Electronic Engineers) 802.11 standard provides guidelines for allowing users to wirelessly connect to a network and access basic services provided therein. It has become more evident in recent years that security and controlled access are necessities in light of the large amount of sensitive information that is communicated over networks today.
Traditionally, the security and controlled access efforts of wireless networking, and more specifically of layer 2 and the 802.11 MAC protocol have been directed toward protecting the data content of the transmission and not toward the prevention of session disruption. In other words, prior efforts have only been directed toward protecting the sensitivity of the content of the data transmitted and not toward the protection of the transmission of management frame packets which control the session integrity and quality.
Of course, access to a network can be restricted by any number of methods, including user logins and passwords, network identification of a unique identification number embedded within the network interface card, call-back schemes for dial-up access, and others. These conventional protection schemes are directed toward controlling the overall access to the network services and toward protecting the data transmissions.
Unfortunately, identifying information contained within the management frames transmitted via a network (e.g. IEEE 802.11 network) has not been the focus of protection in traditional security schemes. U.S. patent application Ser. No. 10/687,075, filed on Oct. 16, 2003, the disclosure of which is hereby incorporated by reference herein, discloses a method for protecting the authenticity and integrity of network management frames (for example 802.11 management frames) by providing message authentication checks and replay protection within a given security context. However, it does not fully provide a solution to the specific problem of establishment of the security context. This lack of protection leaves a network vulnerable to attacks whereby an attacker, such as a rogue access point, can spoof Access Point management frames. For example, a rogue access point (AP), which may possibly be a member of a group that has gone rogue, can initiate an attack on one or more stations within a network by sending them a spoofed deauthenticate (DEAUTH) or disassociation request, at which point the client will politely disconnect from their original AP and begin to roam, sometimes roaming to the rogue AP which sent the spoofed request. Additionally, the client side is more vulnerable to attack than the infrastructure side, and yet both have access to the broadcast key. Further, if the attacker is in fact, a legitimate client, the “vulnerability” of the client is not necessarily an issue. Therefore, the risk comes from an “attacker” with possession of the broadcast key—either by being a legitimate client, or by successfully attacking a legitimate client—can then possibly spoof a legitimate access point's broadcast message. The possible scenario of such an attack would be a broadcast disassociate or deauthenticate request.
The foregoing examples of the related art and limitations related therewith are intended to be illustrative and not exclusive. Other limitations of the related art will become apparent to those of skill in the art upon a reading of the specification and a study of the drawings.
The following presents a simplified overview of the example embodiments in order to provide a basic understanding of some aspects of the example embodiments. This overview is not an extensive overview of the example embodiments. It is intended to neither identify key or critical elements of the example embodiments nor delineate the scope of the appended claims. Its sole purpose is to present some concepts of the example embodiments in a simplified form as a prelude to the more detailed description that is presented later.
In accordance with an example embodiment, there is disclosed herein, a wireless access point having at least one link key for securing management frames transmitted to at least one wireless client. The wireless access point is further configured with at least one infrastructure management frame protection (IMFP) key. A method comprises composing a wireless management frame for transmission to one or more wireless clients. The method comprises generating a first message integrity check (MIC) with at least one link key corresponding to the one or more wireless clients. The method comprises appending the first MIC to the wireless management frame. The method also comprises generating a second message integrity check (MIC) with the IMPF key. The method comprises appending the second MIC to the wireless management frame. The method comprises transmitting the wireless management frame to the one or more wireless clients.
In accordance with an example embodiment, there is disclosed herein, a wireless access point having at least one link key for securing management frames transmitted to one or more wireless clients, the wireless access point further configured with at least one infrastructure management frame protection (IMFP) key. The wireless access point comprises a wireless network infrastructure, one or more processors, and a memory. The wireless access point also comprises a wireless access point application stored in the memory. The wireless access point application includes instructions operable to cause the one or more processors and the wireless network infrastructure to compose a wireless management frame for transmission to one or more wireless clients. The instructions are further operable to generate a first message integrity check (MIC) with at least one link key corresponding to the one or more wireless clients. The instructions are operable to append the first MIC to the wireless management frame. The instructions are further operable to generate a second message integrity check (MIC) with the IMFP key. The instructions are operable to append the second MIC to the wireless management frame. The instructions are operable to transmit the wireless management frame to the one or more wireless clients.
In accordance with an example embodiment, there is disclosed herein, a wireless access point having at least one link key securing management frames transmitted to at least one wireless client, the wireless access point further configured with at least one infrastructure management frame protection (IMFP) key. The wireless access point comprises means for composing a wireless management frame for transmission to one or more wireless clients. The wireless access point comprises means for generating a first message integrity check (MIC) with at least one link key corresponding to the one or more wireless clients. The wireless access point also comprises means for appending the first MIC to the wireless management frame. The wireless access point comprises means for generating a second MIC with the IMFP key. The wireless access point comprises means for appending the second MIC to the wireless management frame. The wireless access point also comprises means for transmitting the wireless management frame to the one or more wireless clients.